CyberStrikeAI the threat that converts open source security tools into automated attacks against Fortinet FortiGate firewall

A recent research report rekindles alarms on how open and powerful security tools can end up being reused by malicious actors. Team Cymru experts have linked the safety testing platform to artificial intelligence called CyberStrikeAI with the infrastructure used in a campaign that compromised hundreds of Fortinet FortiGate firewalls in early 2026, and the implications are deep: a tool designed to automate audits can facilitate large-scale automated attacks.

The team led by Will Thomas (known as BushitoToken) published an analysis showing that an IP address associated with the campaign against FortiGate was running a service identified as CyberStrikeAI in port 8080, and that there was traffic between that IP and Fortinet devices that were the target of the intrusion. You can read Team Cymru's report here: Tracking CyberStrikeAI usage. That same activity was the one that he also described months ago BleepingComputer in detail the massive incident against FortiGate.

CyberStrikeAI is open source and its public repository describes a "native IA" platform developed in Go that integrates more than a hundred traditional security tools. In its GitHub page the project explains how it combines network scanners, web analyzers, operating frameworks, password crack tools and post-operation utilities with a decision engine based on language models and automatic agents. The developer's repository appears under the alias Ed1s0nZ in GitHub where you can also see other projects of your authorship aimed at the search for privileges and automated climbing.

The project's power lies in orchestration: combining mature tools such as nmap, mascan, sqlmap or metasploit with IA agents and a coordinator that converts conversational commands into complete attack chains drastically reduces the technical barrier to carry out complex operations. Team Cymru found 21 different IP addresses running CyberStrikeAI instances between 20 January and 26 February 2026, mainly in China, Singapore and Hong Kong, with additional presence in the USA. Japan and Europe.

Beyond engineering, researchers also analyzed the background of the developer. The author's public profile shows activity linked to other IA security projects - PrivHunterAI and InfiltrateX among them - and, according to Team Cymru, there were interactions with organizations that have been identified above as related to operations related to the Chinese State. In December 2025 the creator presented CyberStrikeAI at the "Starlink Project" of Knownsec 404; Knownsec is a Chinese firm with alleged government links that has been reported, such as the analysis published by DomainTools: The KnownSec leak. In addition, the developer's public mention of a CNNVD reward was removed from the profile later; CNNVD is the Chinese database of vulnerabilities that some analysts have associated with government uses according to reports such as the Cyberscoop.

The convergence of IA and operating tools is an ethical and practical disjunctive. On the one hand, such platforms can accelerate legitimate testing and improve defensive preparation by automating detection, attack chain analysis and vulnerability management. On the other hand, when they fall into wrong hands or are used from infrastructure controlled by hostile actors, support the automation of targeted attacks against devices exposed at the edge of the network such as firewalls, VPN applications and remote access equipment, exactly the targets observed in the campaign against FortiGate.

The operational consequences are clear: the use of IA orchestrators allows operators with limited skills to run sophisticated recognition, exploitation and post-exploitation campaigns without the need to master each tool separately. Team Cymru warns that this dynamic can increase the speed and scope of campaigns as more actors adopt similar orchestration engines. The team's own analysis describes the trend and suggests that defenders should prepare for an environment in which tools such as CyberStrikeAI significantly reduce the effort required to exploit complex networks.

This is not an isolated phenomenon: both security providers and researchers have warned about the abuse of generative models and commercial platforms of IA in malicious activities. In recent reports the industry has documented how people and groups use advanced models to automate phases of the attack - from social engineering to the generation of operating scripts - thus amplifying the capacity of low-resource actors. Therefore, in addition to technical analysis, it is essential to incorporate organized response and mitigation measures.

In practice, the defence should combine network monitoring with perimeter exposure controls, strict credentials management and clear governance on telemetry and administrative access. Security teams need to have abnormal traffic visibility, full audit records and processes to detect unauthorized services such as password-protected web panels or orchestration servers that are not part of the official inventory. Similarly, updating and patching edge devices remains essential for closing vectors that these automated platforms exploit.

The lesson that this case leaves is double: the capabilities that the IA brings to cybersecurity are enormous and can be very beneficial when used with responsibility, but the same power increases the damage when applied for offensive purposes. To deepen Team Cymru's research and to contrast the findings, you can consult his report at: Tracking CyberStrikeAI usage as well as the media coverage of the FortiGate campaign in BleepingComputer and the project repository in GitHub.

Public and technical discussion must move forward in two directions: to promote frameworks that facilitate the responsible use of these platforms in legal and consensual evidence, and at the same time to develop countermeasures that make their abuse difficult. If industry, companies and policy makers are able to coordinate, it will be possible to take advantage of the virtues of automation without giving the attackers a large-scale attack factory.